For safety reasons, accesses to hazardous areas of machines are secured by protective devices, in particular electro-sensitive protective equipment that initiates suitable protective measures on an unintended or unauthorized penetration of persons into this hazardous area. Optoelectronic sensors such as light barriers, light curtains, light sensors, light scanners or the like or also ultrasound sensors are used as protective devices, for example. An object registration signal or a detection signal is generated on an infringement of a protective field. If such a detection signal is received, a corresponding shutdown command is generated that as a rule results in an immediate shutdown of the machine or that at least sets the machine to a state in which a danger to persons is excluded. However, it is necessary for a proper operation of the machine that workpieces to be machined can be supplied to the machine without hindrance and can also be led away from it again without in infringement of a protected field that necessarily occurs interrupting the operation of the machine in so doing.
For this purpose, a safety controller of the category is used that is connected both to the protective device and to the machine to be monitored and has at least one bypass input also called a muting input. It can be signaled to the safety controller via this bypass input that a workpiece has to pass through the protected field of the protective device. The signaling independent control system can in particular be a control system that is also provided for a process control of the machine to be monitored and in particular also for a the control of a conveying device coupled to the machine. If the safety controller receives such a muting or bypass demand, the safety controller switches to the bypass mode that is also called muting operation. The detection signal that necessarily occurs on the entry of the workpiece into the protected field is ignored in this bypass mode in a manner such that at least no shutdown command is output to the machine to be monitored and controlled.
It is necessary for a safe and simultaneously reliable operation of the machine that the time duration for which the safety controller is operated in the bypass mode is adapted to the time duration that a workpiece requires to pass the protective device. If the bypass mode is active for longer than necessary, there is a risk that persons can penetrate into the machine in an unrecognized manner in front of or behind a workpiece. On the other hand, too short an operating duration in the bypass mode has the result that a workpiece that is permitted per se is recognized as a supposedly not allowed object and that a shutdown command is accordingly incorrectly output that leads to an unnecessary standstill of the machine.
A safety controller of the category is described in EP 2 306 063 B1, for example. In this safety controller, a check is first made after the reception of a bypass demand whether a detection signal is generated by the protective device within a predefined time interval, with this time interval amounting to a maximum of 4 s. If this condition is satisfied, the protective device is bypassed for a specific time duration, i.e. the safety controller is operated in a bypass mode so that an object detection by the protective device no longer results in a shutdown command for the machine and a workpiece can thereby pass the protective device. The safety controller and the protective device are integrated in a so-called safety sensor, whereby it can be difficult to obtain diagnostic information in the event of any error function. In addition, the temporal relationships in the protected field monitoring are fixedly parameterized so that flexibility and safety are restricted.